2010-7199. Notice: Request for Substantive Comments on the EAC's Proposed Requirements for the Testing of Pilot Voting Systems To Serve UOCAVA Voters

AGENCY:

United States Election Assistance Commission.

ACTION:

Request for public comment on proposed requirements for the testing of pilot voting systems to be used to serve UOCAVA voters.

SUMMARY:

The U.S. Election Assistance Commission (EAC) is publishing for public comment a set of proposed requirements for the testing of pilot voting systems to be used by jurisdictions to serve Uniformed and Overseas voters.

SUPPLEMENTARY INFORMATION:

Background: The Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) of 1986 protects the right to vote in Federal elections for this defined category of citizens. UOCAVA sets out federal and state responsibilities to assist these voters in exercising their voting rights. The Secretary of Defense is the presidential designee responsible for the Federal functions of the Act. The Federal Voting Assistance Program (FVAP) administers this law on behalf of the Secretary of Defense and works cooperatively with other Federal agencies and state and local election officials to carry out its provisions.

UOCAVA legislation was enacted before the advent of today's global electronic communications technology. Consequently it relied on U.S. domestic and military mail systems as well as foreign postal systems for the worldwide distribution of election materials. By the mid-1990s it became apparent that the mail transit time and unreliable delivery posed significant barriers for many UOCAVA citizens, preventing them from successfully exercising their right to vote. At the same time the Internet was being widely adopted by businesses, governments and the general public. Therefore it was a natural development for FVAP and states to consider the potential of the Internet as an alternative to the “by-mail” UOCAVA process.

FVAP sponsored Voting Over the Internet (VOI), a small pilot project for the November 2000 general election, to examine the feasibility of using Internet technology. Four states participated in this experiment, which enabled voters to use their own personal computers to securely register to vote, request and receive absentee ballots, and return their voted ballots. Following the successful completion of the VOI project, in the Fiscal Year 2002 National Defense Authorization Act (section 1604 of Pub. L. 107-107:115 Stat. 1277), Congress instructed the Secretary of Defense to carry out a larger demonstration project for the November 2002 general election. This project was to be “carried out with participation of sufficient numbers of absent uniformed services voters so that the results are statistically significant”.

Since there was not sufficient time to define and implement a large project for 2002, the project was planned for implementation for the November 2004 election. Seven states agreed to participate and worked with FVAP to develop system requirements and operating procedures. However, the Secure Electronic Registration and Voting Experiment (SERVE) was cancelled before it was deployed due to concerns raised by several computer scientists. These individuals contended that the use of personal computers over the Internet could not be made secure enough for voting and consequently called for the project to be terminated. The Department of Defense, citing a lack of public confidence in the SERVE system, decided the project could not continue under these circumstances.

In response to this development, the Fiscal Year 2005 National Defense Authorization Act (section 567 of Pub. L. 108-375;118 Stat. 119) repealed the requirement for the Secretary of Defense to conduct an electronic voting demonstration project “until the first regularly scheduled general election for federal office which occurs after the Election Assistance Commission (EAC) notifies the Secretary that the Commission has established electronic absentee voting guidelines and certifies that it will assist the Secretary in carrying out the project”. Pursuant to this legislation, in September 2005, the EAC requested its voting system advisory group, the Technical Guidelines Development Committee (TGDC), to add this subject on their research agenda; however the request was declined.

Since that time legislation dealing with a number of UOCAVA voting issues were under consideration by Congress. Ultimately, passed as part of the Fiscal Year 2010 National Defense Authorization Act (NDAA) (section 581 of Pub. L. 111-84), the Military and Overseas Voters Empowerment Act contains a provision allowing the Secretary of Defense to establish one or more pilot programs to test the feasibility of new election technology for UOCAVA voters. This provision requires the EAC and the National Institute of Standards and Technology (NIST) to provide best practices or standards to support these pilot programs, “in accordance with electronic absentee voting guidelines established under” the earlier FY2005 NDAA. In December 2009, the EAC directed the TGDC to begin this work as a top research priority. The EAC expects this work to result in the comprehensive set of remote electronic voting system guidelines as mandated by the FY2005 NDAA. The TGDC has been tasked to consider the full range of remote voting architectures, including instances where the voter can use his own personal computer for voting. The pilot testing requirements, that the EAC is currently developing, will be provided to the TGDC as the basis and starting point for their research and deliberations.

Project Summary: Since 2008, several states have enacted legislation enabling them to conduct electronic voting projects for UOCAVA voters, beginning with the 2010 elections. To be prepared to support the states with these projects, in July 2009 the EAC convened a UOCAVA Working Group to consider how to adapt the EAC's Testing and Certification Program to accommodate UOCAVA pilot systems. It was concluded that two products were needed: (1) A modified set of system testing requirements; and (2) a revised testing and certification process. It was determined that a working group would assist the EAC in drafting the testing requirements and EAC staff would adapt the certification process to accommodate the UOCAVA pilot program.

The EAC UOCAVA Working Group has taken much the same approach as the state pilot project working groups. The source materials drawn on for this effort included: the Voluntary Voting System Guidelines (VVSG) 1.0 ; the VVSG 1.1; the VVSG 2.0; the VOI, SERVE; FIPS; and NIST Special Publications. One significant difference in the EAC Working Group approach was the technology scope covered by the requirements. The VOI, SERVE and Okaloosa system requirements were tailored specifically for the particular system implementations developed for those projects. However, since many different types of remote voting systems could be submitted to the EAC certification program, the EAC Working Group defined generic system requirements to provide for system design flexibility.

Pilot projects are small in scale and short in duration. Consequently, certification for pilot systems needs to be quicker and less expensive than the regular process currently used for conventional systems with an expected life of more than 10 years. Nevertheless, since actual votes will be cast using the voting systems utilized in the pilot project, the certification process must retain sufficient rigor to provide reasonable assurance that the pilot systems will operate correctly and securely.

There is a fundamental dichotomy in complexity in remote voting architectures: those where the voting platform is controlled (e.g., provided by the election jurisdiction); and those where it is not controlled (e.g., the voter uses his own personal computer). Since the EAC plans to have the pilot certification process ready for implementation during the first half of 2010, it was decided that the EAC would focus its efforts on controlled platform architectures servicing multiple jurisdictions. This is a highly secure remote voting solution and the Okaloosa Project provides an implementation example for reference. Defining requirements for this class of system architecture was determined to provide a reasonable test case that could be completed within the available timeframe. In addition, most of the core system processing functions are the same for both types of architectures, so a substantial number of requirements will carry over as this work is expanded to include other methods of remote electronic voting.

The UOCAVA Pilot requirements document contains testable requirements for the following areas:

(1) Functional Requirements.

(2) Usability.

(3) Software.

(4) Security.

(5) Quality Assurance.

(6) Configuration Management.

(7) Technical Data Package.

(8) Systems Users Manual.

DATES:

Comments must be received on or before 4 p.m. EST on April 15, 2010.

Submission of Comments: The public may submit comments through one of the two different methods provided by the EAC: (1) e-mail submissions to [e-mail]; (2) by mail to Voluntary Voting System Guidelines Comments, U.S. Election Assistance Commission, 1201 New York Ave., NW., Suite 300, Washington, DC 20005.

In order to allow efficient and effective review of comments the EAC requests that:

(1) Comments refer to the specific section that is the subject of the comment.

(2) General comments regarding the entire document or comments that refer to more than one section be made as specifically as possible so that EAC can clearly understand to which portion(s) of the documents the comment refers.

(3) To the extent that a comment suggests a change in the wording of a requirement or section of the guidelines, please provide proposed language for the suggested change.

All comments submitted will be published at the end of the comment period on the EAC's Web site at http://www.eac.gov. This publication and request for comment is not required under the rulemaking, adjudicative, or licensing provisions of the Administrative Procedures Act (APA). It is a voluntary effort by the EAC to gather input from the public on the EAC's administrative procedures for certifying voting systems to be used in pilot projects. Furthermore, this request by the EAC for public comment is not intended to make any of the APA's rulemaking provisions applicable to development of this or future EAC procedural programs.

An electronic copy of the proposed guidance may be found on the EAC's Web site at http://www.eac.gov.

FOR FURTHER INFORMATION CONTACT:

Matthew Masterson, Phone [phone], e-mail [e-mail].

Alice Miller,

Chief Operating Officer, U.S. Election Assistance Commission.